Session Hijacking Testing
Session hijacking testing checks whether an attacker can steal or forge a valid user session — through session ID theft, prediction, or fixation — and use it to impersonate the legitimate user without needing their actual credentials.
Testing typically covers: whether session tokens are transmitted only over HTTPS (never exposed in plain HTTP), whether session IDs are sufficiently random and unpredictable, whether sessions properly expire and rotate after login (preventing session fixation, where an attacker sets a known session ID before a victim logs in), and whether logging out actually invalidates the session server-side, not just client-side.
A session token is functionally equivalent to a password for the duration it's valid — any testing that only checks password strength while ignoring how sessions are generated, transmitted, and invalidated is missing an equally critical part of the authentication story.
